Third-Party Risk in Integrated Enterprise Risk Management

• Inventory and tiering. Every third party with access to systems, data, facilities, or critical processes is known and tiered by the consequence of its failure or compromise, not by contract value.
• Due diligence proportional to tier. High-consequence relationships receive substantive evaluation: security posture, financial stability, concentration risk, and subcontractor visibility. Low-consequence relationships receive proportionally lighter review, which preserves capacity for the ones that matter.
• Contractual controls. Security requirements, incident notification timelines, audit rights, data handling terms, and termination assistance are set in the contract, because the negotiation is the only moment of maximum leverage.
• Continuous oversight. Point-in-time questionnaires decay quickly. Material relationships need ongoing signals: reassessment on a defined cadence, monitoring where feasible, and contractually required disclosure of significant changes.
• Offboarding. Access is revoked, data is returned or destroyed with evidence, and dependencies are unwound deliberately when the relationship ends.

NIST guidance on cybersecurity supply chain risk management (SP 800-161) and the supply chain category within the NIST Cybersecurity Framework both make the same structural point: third-party risk is an enterprise governance function that draws on procurement, security, legal, and the business owner of each relationship. In practice that means one accountable executive, one tiering standard, and one reporting line into the enterprise risk committee, so the board sees concentration and aggregate exposure rather than a stack of departmental scorecards.

Fourth-party visibility follows from the same discipline. An organization cannot review every subcontractor, but it can require material vendors to disclose their own critical dependencies and can treat refusal as a risk signal.

• Leadership can name the ten relationships whose failure would hurt most, and the current risk position of each.
• Tiering decisions are made by consequence, and a vendor's tier changes when its access or role changes.
• Incident notification obligations have been tested, not merely signed.
• Concentration risk, including shared dependence on one cloud region or one logistics corridor, appears in enterprise risk reporting.
• Risk acceptance is explicit: when the business proceeds with a flagged vendor, a named executive signs the acceptance.